Re: Limiting SECCOMP audit events

From: Steve Grubb <sgrubb@redhat.com>
To: Tyler Hicks <tyhicks@canonical.com>
Cc: Linux Audit <linux-audit@redhat.com>
Subject: Re: Limiting SECCOMP audit events
Date: Thu, 14 Dec 2017 10:19:41 -0500	[thread overview]
Message-ID: <3499769.OM7YpPIT3e@x2> (raw)
In-Reply-To: <36cd827f-201c-8f76-2883-ecd930cbb1f4@canonical.com>

[-- Attachment #1.1: Type: text/plain, Size: 1874 bytes --]

On Thursday, December 14, 2017 10:04:48 AM EST Tyler Hicks wrote:
> On 12/13/2017 05:58 PM, Steve Grubb wrote:
> > Over the last month, the amount of seccomp events in audit logs is
> > sky-rocketing. I have over a million events in the last 2 days. Most of
> > this is generated by firefox and qt webkit.
> > 
> > I am wondering if the audit package should ship a file for
> > 
> > /usr/lib/sysctl.d/60-auditd.conf
> > 
> > wherein it has
> > 
> > kernel.seccomp.actions_logged = kill_process kill_thread errno
> 
> I agree with Kees here. IMO, you only want "kill_process kill_thread"
> which is the default.

The default appears to be all of the types of events without setting  
kernel.seccomp.actions_logged.

> > Also, has anyone verified this sysctl is filtering audit events? Even
> > with the above, I have over a million events on a 4.14.3 kernel. Firefox
> > alone is generating over 50,000 events per hour.
> 
> Yes. I tested it a lot as the changes were being upstreamed and again
> when I backported the changes to Ubuntu releases 17.10, 17.04, and 16.04
> LTS. Those kernels have been released for a month and a half now and I
> haven't heard of any issues.

Apparently I misunderstood this as a filter for audit events to be blocked.

> I'll install a Fedora VM and see if I can determine what's happening.

I'm testing on F27 if that matters. It would appear to me that seccomp filtering is 
becoming more used and is now dominating the events going into the audit logs.

# uptime
 10:17:34 up  1:27,  1 user,  load average: 0.23, 0.39, 0.53

[root@x2 ~]# ausearch --start today --raw | aureport --event --summary -i

Event Summary Report
======================
total  type
======================
35561  SECCOMP
1041  SYSCALL
134  SERVICE_START
75  NETFILTER_CFG
46  SERVICE_STOP
46  CONFIG_CHANGE
24  AVC

All of the seccomp events are trap types.

-Steve

[-- Attachment #1.2: Type: text/html, Size: 10072 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]